I've a mapping site where users have to login in with username and password. Once logged in the user gets a map of their data using WMS and WFS to display and edit data. This data is served using GeoServer and displayed using OpenLayers. The WMS on the layer is secured using a username\password. I've seen similar questions to this but basically I want to access the secured layers via WMS without exposing my username\password. Any advice\clarity would be appreciated - my own thoughts are as follows:

  1. User logs in to website.
  2. WMS request using HTTPS for their specific information - uses some filter based upon who they are.
  3. How do I send this filter without exposing it in the WMS call?
  4. How do I send username\password without exposing it in WMS call?

Theres lots of talk about reverse proxies - do I send the WMS request with no username\password then when the request reaches the proxy I validate the user then modify the request by adding the WMS username\password using the reverse proxy. If so dont I still need to send some identifier to determine who sent the request or will the proxy knows this due to the users session?

Basically any help would be appreciated

2 Answers 2


how about this: http://osgeo-org.1560.x6.nabble.com/Load-GeoServer-WMS-secured-layers-with-OpenLayers-td3919938.html, basically it uses a proxy script to do what you need.

  • Thanks. I had read this post but was still unsure how the OL4JSFProxy knew the credentials of the user that sent the initial request. Is this just stored in the session data? Also is this what other users are using in Production environments?
    – gisWeeper
    May 27, 2013 at 12:45
  • I know there are some guys using web frameworks like this for production, however this probably goes beyond the specific user/password thing you need.
    – Gery
    May 27, 2013 at 13:40
  • The link does not exist anymore...
    – shanti
    Jun 10, 2022 at 13:59

GeoPrisma might fit your needs. It's a web mapping application featuring Access Control (Permissions) to geospacial data (Resources). It also has a proxy that allows/denies access to a Resource depending on your permission to that Resource. As an added bonus, it also has templates and widgets that you can use for your application.

  • Thanks for reply. Is this what other users are using in Production environments?
    – gisWeeper
    May 27, 2013 at 12:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.